VulnerabilityModified
CVE-2017-9948
A stack buffer overflow vulnerability has been discovered in Microsoft Skype 7.2, 7.35, and 7.36 before 7.37, involving MSFTEDIT.DLL mishandling of remote RDP clipboard content within the message box.
HIGH 8.8EPSS 6.43%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A stack buffer overflow vulnerability has been discovered in Microsoft Skype 7.2, 7.35, and 7.36 before 7.37, involving MSFTEDIT.DLL mishandling of remote RDP clipboard content within the message box.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.43% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- microsoft/skype
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/99281Third Party Advisory, VDB Entry
- https://www.vulnerability-db.com/?q=articles/2017/05/28/stack-buffer-overflow-zero-day-vulnerability-uncovered-microsoft-skype-v72-v735Third Party Advisory, VDB Entry
- https://www.vulnerability-lab.com/get_content.php?id=2071Mailing List, Third Party Advisory
- https://www.vulnerability-lab.com/get_content.php?id=2084Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/99281Third Party Advisory, VDB Entry
- https://www.vulnerability-db.com/?q=articles/2017/05/28/stack-buffer-overflow-zero-day-vulnerability-uncovered-microsoft-skype-v72-v735Third Party Advisory, VDB Entry
- https://www.vulnerability-lab.com/get_content.php?id=2071Mailing List, Third Party Advisory
- https://www.vulnerability-lab.com/get_content.php?id=2084Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.